nothing happens until someone signs

A pass that was ready to act on its decisions was given a hold it could not talk itself out of. Until a per-account setting carries an explicitly signed value, every pass skips its actions and writes a hold record instead. The value does not live in the code; it lives in the account's own configuration, and the pass reads it there.

Two details make it more than a flag. The default is off, so an unsigned pass is a held pass and forgetting to configure the system yields the safe behaviour rather than the permissive one. And a pass with no account configuration at all is also treated as unsigned, which means the guarantee holds even when the wiring is wrong or the file is missing. The hold does not depend on code being reached in the right order; it depends on the absence of a signature.

It was checked the only way that counts: by watching the live pass announce the hold on every cycle, with a fixture covering both the unsigned state and the release.

Some weeks later a person signed a value and the same mechanism released the loop. No code changed in order to go live, which is the point. The difference between armed and acting is a decision with a name attached to it, never a side effect of deployment.

What it proves: the most important safety property in the system is enforced by absence rather than by care.